Cookies and Sessions in Web Development: Complete Guide

<?php
// Set the cookie rules BEFORE starting the session
session_set_cookie_params([
  'lifetime' => 0,          // 0 = until the browser closes
  'path'     => '/',
  'secure'   => true,       // HTTPS only
  'httponly' => true,       // JavaScript cannot read it
  'samesite' => 'Lax',      // blocks most CSRF attacks
]);
session_start();

if (password_verify($_POST['password'], $user['password_hash'])) {

  // Critical: new ID on login, to stop session fixation
  session_regenerate_id(true);

  $_SESSION['user_id']   = $user['id'];
  $_SESSION['role']      = $user['role'];
  $_SESSION['last_seen'] = time();

  header('Location: /dashboard.php');
  exit;
}

<?php
session_start();

// Not logged in? Send them away.
if (empty($_SESSION['user_id'])) {
  header('Location: /login.php');
  exit;
}

// Log out after 30 minutes of inactivity
if (time() - $_SESSION['last_seen'] > 1800) {
  session_unset();
  session_destroy();
  header('Location: /login.php?timeout=1');
  exit;
}
$_SESSION['last_seen'] = time();

echo 'Welcome back, user #' . $_SESSION['user_id'];

<?php
session_start();
$_SESSION = [];                 // 1. empty the data
setcookie(session_name(), '', time() - 3600, '/');  // 2. kill the cookie
session_destroy();            // 3. delete it on the server
header('Location: /');

const express = require('express');
const session = require('express-session');
const app = express();

app.use(session({
  secret: process.env.SESSION_SECRET,   // never hard-code this
  name: 'sid',                         // avoid the default name
  resave: false,
  saveUninitialized: false,           // no cookie until it is needed
  cookie: {
    httpOnly: true,
    secure: true,                      // HTTPS only
    sameSite: 'lax',
    maxAge: 1000 * 60 * 30            // 30 minutes
  }
  // In production use a real store (Redis, a database),
  // not the default in-memory one.
}));

app.post('/login', async (req, res) => {
  const user = await checkPassword(req.body);
  if (!user) return res.status(401).json({ error: 'Invalid login' });

  req.session.regenerate(() => {        // new ID on login
    req.session.userId = user.id;
    res.json({ ok: true });
  });
});

app.post('/logout', (req, res) => {
  req.session.destroy(() => {
    res.clearCookie('sid');
    res.json({ ok: true });
  });
});

// Write a cookie that lasts a year
document.cookie = 'theme=dark; Max-Age=31536000; Path=/; Secure; SameSite=Lax';

// Read one back
function getCookie(name) {
  return document.cookie
    .split('; ')
    .find(row => row.startsWith(name + '='))
    ?.split('=')[1];
}

// Delete one: set it to a date in the past
document.cookie = 'theme=; Max-Age=0; Path=/';

// For data the server never needs, localStorage is simpler
localStorage.setItem('theme', 'dark');

Set-Cookie: sid=7f3a9b2c4e8d1f60; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1800